Headline
CVE-2022-30885: code execution backdoor · Issue #39 · esdc-esac-esa-int/pyesasky
** Reserved ** The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2.
We found a malicious backdoor in versions 1.2.0~1.4.2 of this project, and its malicious backdoor is the request package. Even if the request package was removed by pypi, many mirror sites did not completely delete this package, so it could still be installed.When using pip3 install pyesasky==1.4.2 -i http://pypi.doubanio.com/simple --trusted-host pypi.doubanio.com, the request malicious plugin can be successfully installed.
Repair suggestion: delete version 1.2.0~1.4.2 in PyPI.